Support GCS Workload Identity in CRD (credentials.workloadIdentity) for backup storage

[TineoC]

Problem

The operator 1.22.0 Go code already has the concept of Workload Identity — the error message confirms this:

clientEmail and privateKey are required for GCS credentials when workloadIdentity is not enabled

However:

1. The CRD schema for PerconaServerMongoDB does not expose a credentials.workloadIdentity field under spec.backup.storages[].gcs
2. credentialsSecret is still marked as required in the GCS storage spec
3. Even when the CRD is manually patched to add credentials.workloadIdentity: true, the operator's Go struct does not deserialize or pass it to PBM's configuration

This means GKE environments using Workload Identity (Google's recommended approach for avoiding exported service account keys) cannot use GCS backups without a workaround.

Context

• PBM 2.13.0 (released 2026-03-03) added native GCS Workload Identity Federation support (release notes)
• The operator image 1.22.0 has the error path that checks for workloadIdentity but does not expose it through the CRD or Go structs
• The Percona Server MongoDB pods run with a Kubernetes Service Account that has GKE Workload Identity configured, granting roles/storage.objectUser on the backup GCS bucket
• PBM 2.13.0 running inside those pods can authenticate via WI natively, but the operator never tells PBM to use it

Proposed Fix

1. Add credentials.workloadIdentity (boolean) to spec.backup.storages[].gcs in the CRD schema
2. Make credentialsSecret optional when credentials.workloadIdentity: true
3. When the flag is set, the operator should skip credential secret parsing and configure PBM to use the pod's service account identity (WI) for GCS authentication
4. This aligns with PBM 2.13.0's native WIF support

Current Workaround

1. Manually patch the CRD via kubectl apply --server-side --force-conflicts to add the credentials field and remove credentialsSecret from required
2. Create a placeholder secret with dummy content
3. Neither workaround fully works because the operator Go code does not read or pass credentials.workloadIdentity to PBM

Environment

• Operator: 1.22.0 (Chainguard FIPS image: cgr.dev/gameplantech/percona-server-mongodb-operator-fips:1)
• PBM: 2.13.0
• Platform: GKE Autopilot with Workload Identity
• Helm chart: psmdb-db 1.21.3 / psmdb-operator subchart 1.21.2
• IL4 environment where exporting service account JSON keys is not permitted

[egegunes]

This will be done under https://perconadev.atlassian.net/browse/K8SPSMDB-1602